Forum Discussion
Power BI Migration – Accessing SharePoint, Databricks from other Tenant via B2B
Hi,
We are working on a Power BI migration from the INFY tenant to the TATA tenant.
In our current setup:
SharePoint Online, Databricks is hosted in the INFY tenant.
Some users have been migrated to the TATA tenant.
After migration, these users will have Azure AD B2B guest/member access to the INFY tenant.
Eg. current email [email protected], after migration/cutoff his email will be same [email protected]
Question:
a. Will migrated TATA users (with B2B guest access) be able to access SharePoint in the INFY tenant and use it as a data source for Power BI reports hosted in INFY?
b. Will migrated TATA users (with B2B guest access) be able to access Databricks in the INFY tenant and use it as a data source for Power BI reports hosted in INFY?
Any considerations around permissions, licensing, or limitations would be helpful.
Thanks,
Thanks for taking the time.
1. Yes, you'll need to reassign permissions for the new guest accounts in the INFY tenant. Although the email remains the same, the underlying identity changes, so SharePoint won’t recognize them automatically. Go to the SharePoint site, then Settings-Site Permissions - Share site, and enter the guest user’s email. Make sure the guest user has already been invited to the INFY tenant before granting access.
2. You also need to manually re add the guest users in the INFY hosted Databricks workspace. This involves adding them in the Admin Console under Users and reassigning access to clusters, SQL warehouses, tables, and DBFS folders.
3. Since you’re using OAuth for Databricks, you’ll need to re authenticate the dataset connection in Power BI Service. Go to the workspace, then Dataset Settings- Data Source Credentials, and re authenticate using the guest account’s token.
4. Your understanding is correct here as well. Add the guest user to the same roles as before, and if you’re using Row Level Security, ensure they’re assigned to the correct roles in the dataset security settings.Hope this helps.
6 Replies
As far as I'm aware, when you go to a new tenant, even though they will have the same email address as the underlying Guids, which is the actual identifier, will all be changed. So you would have to remap this access in both of your scenarios.
Thanks for your reply. When you say "you would have to remap this access", could you please clarify exactly what needs to be remapped?
Do you mean:
- Reassigning SharePoint permissions for the migrated TATA users in the INFY tenant?
- Reassigning Databricks workspace permissions in the INFY tenant?
- Updating Power BI dataset credentials/connections?
Just want to confirm if the remapping is required for both the data source level (SharePoint/Databricks) and the report-level permissions in Power BI, or only at one layer.
Thanks,
Thank you for your question. When users move from the INFY tenant to the TATA tenant and then receive B2B guest access back into INFY, their Azure AD identity changes, even if their email remains the same. This means any permissions linked to their original identity won’t transfer automatically.
You will need to
1. Reassign SharePoint permissions in INFY for the new guest accounts
2. Reassign Databricks workspace, cluster, and table permissions in INFY
3. Update Power BI dataset credentials if they connect to SharePoint or Databricks
4. Reassign Power BI workspace/report/RLS roles for the new guest accounts
Best regards,
Yugandhar.
